CVE-2026-119728
Description
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
Statement
This vulnerability is rated as Moderate severity because exploitation causes denial of service (application crash) when a user or service processes a crafted H.264 Multiview (MVC) stream. No confidentiality or integrity impact was identified. User interaction is required when the attack uses a local media file.
Upstream fixed the issue in gst-plugins-bad 1.28.2. Red Hat ships gstreamer1-plugins-bad-free builds below 1.28.2 on active RHEL and RHIVOS streams; those packages include the H.264 MVC SPS parser and are affected. Fedora 44 and Fedora Rawhide already ship 1.28.8 and are not affected.
Legacy GStreamer 0.10 packages (gstreamer-plugins-bad-free on RHEL 6 Extended Life Cycle Support and the parallel 0.10 package on RHEL 7 Extended Life Cycle Support) do not ship the gst-plugins-bad H.264 codeparser MVC path and are not affected.
Exploitation requires processing H.264 content with MULTIVIEW_HIGH or STEREO_HIGH profile Subset SPS NAL units; standard AVC streams do not trigger the vulnerable path.
Mitigation
No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 5.5 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Red Hat CVSS v3 Score Explanation
RH assessment: file-based DoS; advisory framing uses local file vector
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
